NGFW-Engineer Practice Test 3 — 25 Questions

Question 1

Which tab is used to view real-time log activity?

Accepted Answer

Monitor. The 'Monitor' tab provides real-time access to traffic, threat, and system logs.

Answer

Objects

Answer

Policies

Answer

Dashboard

Question 2

What is the default action for the 'interzone-default' security policy?

Accepted Answer

Drop. The default security policy for traffic moving between different zones is to drop it.

Answer

Alert

Answer

Allow

Answer

Reset

Question 3

What is the purpose of a 'Zone' in a Palo Alto Networks firewall?

Accepted Answer

To define the scope of security policies. Zones are logical groupings of interfaces that allow for the application of security policies to traffic moving between them.

Answer

To segment the network for routing

Answer

To increase bandwidth

Answer

To manage user identities

Question 4

What is the recommended method to update the firewall's threat signatures?

Accepted Answer

Dynamic Updates. Dynamic Updates under Device > Dynamic Updates allows for downloading and installing the latest signature packages.

Answer

Manual firmware upgrade

Answer

App-ID update

Answer

Policy import

Question 5

Which TWO types of NAT are supported in PAN-OS?

Accepted Answer

Source NAT. Source NAT and Destination NAT are the two primary NAT types.

Answer

Global NAT

Answer

Layer 2 NAT

Answer

Application NAT

Question 6

You are configuring a BGP peer. The connection stays in 'Active' state. What is the most likely cause?

Accepted Answer

TCP port 179 is blocked or no route to peer. The 'Active' state in BGP usually indicates the firewall is trying to initiate a TCP connection to the neighbor, but is failing, often due to routing or firewall policy blocking port 179.

Answer

Keepalive timer mismatch

Answer

AS number mismatch

Answer

Router ID is the same

Question 7

What is the effect of changing the HA heartbeat interval?

Accepted Answer

Changes the detection time for peer failures. Changing the heartbeat interval affects how quickly the firewall detects a peer failure; shorter intervals increase sensitivity but also increase the risk of false failovers.

Answer

Disables session preemption

Answer

Changes the synchronization time for configuration

Answer

Changes the speed of the control link

Question 8

In a Site-to-Site VPN, which setting determines how the firewall handles traffic that does not match the phase 2 selector?

Accepted Answer

Proxy ID. The Proxy ID configuration in the IKE Gateway/IPsec tunnel settings defines exactly which traffic (source/destination/protocol) is permitted through the tunnel; unmatched traffic is dropped or routed outside the tunnel.

Answer

Re-key interval

Answer

Dead Peer Detection

Answer

IKE Crypto Profile

Question 9

Which TWO issues can prevent BGP from reaching the 'Established' state?

Accepted Answer

Blocked TCP port 179. BGP will not establish if there is a mismatch in AS numbers or if TCP port 179 is blocked.

Answer

Router ID mismatch

Answer

Keepalive timer mismatch

Answer

Area ID mismatch

Question 10

How do you ensure that a specific security policy rule is only active during business hours?

Accepted Answer

Create a Schedule object. The 'Schedule' object allows you to define time-based constraints for policy rules.

Answer

Use a Security Profile

Answer

Use a Dynamic Address Group

Answer

Manually disable it

Question 11

Which TWO features require a valid subscription license?

Accepted Answer

URL Filtering. Advanced threat features like URL filtering and Threat Prevention (Antivirus/Vulnerability) require active subscriptions.

Answer

Static Routing

Answer

Interface creation

Answer

NAT

Question 12

Which THREE items are found under the 'Network' tab?

Accepted Answer

Zones. The Network tab covers interfaces, virtual routers, and zones.

Answer

Security Profiles

Answer

Certificate Management

Question 13

Which feature is used to ensure the firewall clock is accurate?

Accepted Answer

NTP. NTP (Network Time Protocol) settings under Device > Setup > Services are used to synchronize time.

Answer

DHCP

Answer

DNS

Answer

SNMP

Question 14

What must you do after making any change in the web interface to make it active?

Accepted Answer

Commit the configuration. Changes on a Palo Alto firewall are 'staged' and only active once the 'Commit' button is pressed.

Answer

Log out

Answer

Refresh the browser

Answer

Save the configuration

Question 15

What is the recommended way to manage certificates on a Palo Alto Networks firewall?

Accepted Answer

Use the Device > Certificate Management tab. The Certificate Management section under Device > Certificate Management allows for importing, generating, and managing certificates.

Answer

Apply them via a security policy

Answer

Store them in a global address object

Answer

Manually copy files to the CLI

Question 16

Which feature helps to identify and block traffic from compromised hosts based on suspicious behavior?

Accepted Answer

Threat Prevention Profiles. Threat Prevention profiles (specifically Anti-Spyware/Vulnerability Protection) detect command-and-control activity and suspicious traffic patterns.

Answer

GlobalProtect

Answer

NAT

Answer

URL Filtering

Question 17

What is the purpose of the 'Policy Optimizer' feature?

Accepted Answer

To identify and clean up unused rules. Policy Optimizer helps identify unused rules and improve policy efficiency by suggesting changes to security rules.

Answer

To increase throughput

Answer

To update threat signatures

Answer

To automatically create NAT rules

Question 18

When configuring an interface, what is the role of a 'Security Zone'?

Accepted Answer

To associate the interface with policy rules. Assigning an interface to a security zone makes it eligible for participation in security policies.

Answer

To assign an IP address

Answer

To enable management

Answer

To handle routing

Question 19

You need to perform a packet capture on a specific firewall interface. Which tool is used?

Accepted Answer

Monitor > Packet Capture. The Packet Capture tool under Monitor > Packet Capture allows for selecting interfaces and defining filters.

Answer

Policies > Security

Answer

Device > Setup > Logging

Answer

Network > Interfaces

Question 20

How do you ensure that only the most secure TLS versions are used for management access?

Accepted Answer

Via SSL/TLS Service Profile. SSL/TLS service settings under Device > Setup > Management > SSL/TLS Service Profile allow you to restrict minimum TLS versions.

Answer

Through an Interface Management Profile

Answer

By disabling HTTPS

Answer

Using a Security Policy